Two vulnerabilities in the PHP runtime — CVE-2026-109618 and CVE-2026-109619, collectively dubbed php2shell — were disclosed October 21, 2026 by Calif.io, Wiz, OpenAI, and Quarkslab. The flaws sit in how PHP handles memory during error conditions: one triggers use of uninitialized data after an out-of-memory event, the other creates dangling references that a subsequent request can follow to read freed memory. Both allow denial of service, remote code execution, and data exposure via crafted HTTP traffic. Every PHP installation from version 5.4 onward is affected. Cloudflare deployed WAF mitigations starting October 21 at 3:02 AM UTC — approximately nine hours before public disclosure — as part of a coordinated effort with the PHP Foundation, OpenAI, and Wiz. Protection was enabled by default across all plan tiers, including free. The company released seven detection rules each for its free managed ruleset and its paid managed ruleset, covering mutation variants it observed attackers attempting in real time. The deeper engineering story is Cloudflare's introduction of full transaction detection, a new WAF capability that analyzes both the HTTP request and the origin server's response within the same transaction. Standard WAF rules inspect only the inbound request, which for php2shell is insufficient — a malicious payload can look identical to legitimate traffic until the server's response reveals whether exploitation succeeded. By matching on the response, Cloudflare can block the exploit result before it reaches the requester while reducing false positives on ambiguous requests. This is the first time Cloudflare has shipped managed detections using this full-transaction capability. The architectural implication is significant: it converts the WAF from a pure request-side gate into a bidirectional filter that can make enforcement decisions based on server behavior. For this specific vulnerability class — memory-safety bugs triggered by request-induced error states — the response signal is the only reliable indicator of exploitation. Cloudflare tracked attackers mutating payloads in real time to attempt bypass and updated rules accordingly. The underlying bugs are structural. PHP allocates memory to process a request and should release it upon completion. When processing halts unexpectedly — out-of-memory in the first CVE, fatal error in the second — cleanup routines operate on memory that is either uninitialized or already freed. An attacker applies pressure (large requests are one vector) to trigger these error paths, then manipulates what PHP finds in the corrupted memory. The second CVE is particularly dangerous: it creates a use-after-free across request boundaries, meaning a later request to the same PHP process can read data from the earlier one. Patching the PHP runtime is the only fix. WAF rules are defense-in-depth, not a substitute. The vulnerability sits below application code, plugins, and frameworks — updating WordPress or Magento does nothing. Hosting providers that manage PHP installations bear the responsibility for their tenants. Cloudflare recommends keeping WAF protections enabled during the patching window and restricting unnecessary uploads to reduce attack surface. The coordinated timeline — mitigations live before disclosure, attack traffic already observed, mutation tracking in progress — suggests this vulnerability was either known to attackers before the intended disclosure date or leaked ahead of schedule. Cloudflare explicitly notes the vulnerability was "leaked before the official release date" and that they observed attack traffic targeting customers before public announcement. The race between disclosure and exploitation is the real story here.
